By default, the ViewState encryption is disabled in the web applications.
So it is recommended not send private data through Viewstate at least that you are not using SSL.
There are two ways to encrypt your ViewState:
1. Encrypt ViewState in every Page
2. Encrypt ViewState in web.config for all pages in your applications In the first case, add the attribute in the directive <%@Page ViewStateEncryptionMode="Always" %> in your single page.
In the second case, add the attribute viewSateEncryptionMode="Always" in your web.config.
Then add the algorithm of decryption in your web.config.
There are much key of decryption, but the key AES is the best for performance and for security.
See the example:
<configuration>
<system.web>
<machineKey decryptionKey="AutoGenerate,IsolateApps" decryption="AES" />
</system.web>
</configuration>
For more informations go to http://msdn2.microsoft.com/en-us/library/ms998288.aspx